Web Security Experts: Are you overlooking WebRTC vulnerabilities?

on YouTube ↗46m

" summary

Findings include TURN relay abuse, RTP injection, and signaling flood with concrete demos: a stunner-based TURN relay probe that abused misconfigured TURN servers (Slack CVE confirmed), an RTP spray that disrupts or injects audio via media servers, and a websocket SIP invite flood that causes signaling DoS. Tools used are Wireshark, GStreamer, and the open source stunner utility, outcomes include confirmed exploits and fixes, a published top seven list, and practical testing steps for TURN, media and signaling.

AI-written summary · about

" chapters (14)

1. 0:00WebRTC security gaps
2. 6:55WebRTC vulnerabilities overlooked
3. 9:51WebRTC security concepts
4. 12:01WebRTC security features
5. 20:12WebRTC attack surface issues
6. 23:03Top WebRTC vulnerabilities
7. 27:19TURN server relay abuse demo
8. 30:18RTP injection attack demo
9. 33:36Signaling flood denial of service attack
10. 37:17Custom signaling protocol risks
11. 38:02WebRTC security testing tools
12. 41:55Auditing WebRTC tips
13. 42:39OWASP ASVS and WebRTC
14. 44:45Conclusion

" related talks

• 11mReal-Time Compromise: Investigating RTC Security in Consumer IoTVictor Goeman, Tom Cordemans, Christoph Sanders, Jorn Lapon, Vincent Naessens · 20th USENIX WOOT Conference on Offensive Technologies (WOOT '26)
• 39mEavesdropping on WebRTC Communication with Funny Cat PicturesMartin Johns · RuhrSec 2016
• 53mVoIP Wars: the Phreakers AwakenFatih Ozavci · Black Hat USA 2016
• 37mWebRTC: From The Ground UpNick Chadwick · Demuxed 2016
• 19mDebugging Tools and Techniques for WebRTCPhilipp Hancke · Kranky Geek WebRTC Brazil 2016
• 45mThe Top 10 Web Hacks of 2014Matt Johansen, Johnathan Kuskos · OWASP AppSec Research (AppSecEU) 2015
• 27mWebRTC: Real-Time CommunicationsYlia Kasianenko · OdessaJS 2015
• 56mModern Web Vulnerabilities 2020Erlend Oftedal · NDC Security Oslo 2020